There is a growing need, in the field of computer networks, to be able to monitor network traffic. A combination of government regulations, quality assurance responsibilities, and competitive necessities has resulted in an industry-wide need to be able to monitor traffic passing through a network. The level or type of monitoring may vary, depending upon the particular task being performed. For example, it might be desirable to monitor all traffic between a specific source and a specific destination, or to gather information about all traffic passing across the network that involves a specific protocol.
Unfortunately, the tools available to network administrators to perform this kind of monitoring are extremely limited. Many layer 2 devices offer a limited “port mirroring” option, which can create a single copy of traffic coming in on a single port, and output that copy to a single destination port. Port mirroring, used in this fashion, does not offer the ability to make multiple copies, e.g., for multiple different monitoring roles, nor does it allow for sending the copied traffic to different destinations.
Alternatively, a physical “tap” can be inserted in-line, and a portion of the signal can be physically diverted. This approach raises issues involving signal degradation, however; moreover, the equipment used in this approach can be extremely expensive.
Some vendors supply a limited software solution, which creates a set number of copies of traffic. However, software solutions are not scalable, particularly at the speed involved in modern network connections. Also, these approaches only create a limited number of copies of the traffic.